Pay TV applications in a conditional access (CA) system use scrambling (also known as encryption) to secure digital TV broadcast streams. Receivers are used to obtain the relevant decryption keys to descramble the stream prior to the rendering of the digital TV streams. Such decryption key is also known as a control word or CW. In a head-end of a digital TV station a sequence of CWs is associated with one or more elementary streams such as audio, video, subtitling, teletext and/or applets. For MPEG2 streams, the elementary streams are identified by a PID (packet identifier). The stream of CWs is usually identifiable by a CW_stream_Id. In the MPEG2 standard, the list of PIDs that make up a TV service (a program stream in MPEG2 terminology) is contained in a clear text PMT (program map table). The CA system employs a similar data structure to map the CW_Stream_ID to a number of PIDs. A decoder in de receiver processes the PMT and a smartcard of the CA system processes the information that links the CW_Stream_ID(s) to the relevant PIDs and sets up the receiver to load the relevant keys to descramble the elementary streams.
To prevent unauthorized access to clear text digital TV streams, it is known to implement the descrambling and the decoding of the digital TV signals in a secure domain of the receiver, typically in a secure chip or chipset.
Known receivers typically take the following steps in processing a MPEG2 stream. MPEG2 packets are received and demodulated. The PID and a scrambling control field are extracted from the MPEG2 header. A CW lookup table in a memory of the receiver is searched for an entry with a matching PID value and associated CW keys are read from the table. The scrambling control field value is used to select from the associated CW keys the CW that needs to be loaded in the descrambler. The scrambled payload of the MPEG2 packet is decrypted in de descrambler using the CW. Information from the clear text MPEG2 PMT is used to determine a stream_type of the packet. The stream_type is a content type identifier identifying the type of content, e.g. audio, video, subtitling, teletext or applet. The stream_type is used to send the packet to the appropriate decoding module.
For the processing of the MPEG2 stream the receiver typically uses the following inputs: the PID value and the scrambling control field from the MPEG2 Packet header and the clear text MPEG2 PMT information of which in particular the PID of the elementary stream and the stream_type associated with the PID.
In order to ensure the intended operation of the receiver, all these input data need to provide accurate information. As the PMT and the MPEG2 packet header are provided in clear text, they can be manipulated before the processing in the receiver. This enables an attacker to change a PID value or a stream_type value and e.g. have a video and audio elementary stream look like a teletext stream. Video streams and audio streams are typically processed in a secured domain of the receiver, while, after descrambling, teletext streams are processed outside the secured domain. Such manipulating of the inputs thus causes the descrambled video and audio elementary stream to exit the secure domain, enabling unauthorized access to these streams and making the processing of the streams unreliable.